CVE-2021-41137 Bypassing policy restrictions on regular users

What is CVE-2021-41137?

CVE-2021-41137 is a high-severity authentication bypass vulnerability in minio, published on 13 Oct 2021. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Minio is a Kubernetes native application for cloud storage. All users on release `RELEASE.2021-10-10T16-53-30Z` are affected by a vulnerability that involves bypassing policy restrictions on regular users. Normally, checkKeyValid() should return owner true for rootCreds. In the affected version, policy restriction did not work properly for users who did not have service (svc) or security token service (STS) accounts. This issue is fixed in `RELEASE.2021-10-13T00-23-17Z`. A downgrade back to release `RELEASE.2021-10-08T23-58-24Z` is available as a workaround.

Weakness: CWE-285

Which versions are affected by CVE-2021-41137?

It affects 1 product.

Products include Minio Minio.

How do I fix CVE-2021-41137?

No fix has been published for CVE-2021-41137 yet. Limit exposure of the affected software until one is available.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2021-41137 being exploited?

There is no known exploitation of CVE-2021-41137 in the wild and no public exploit code.

Other vulnerabilities in minio

• CVE-2023-28434 MinIO Security Feature Bypass Exploited High 8.8
• CVE-2023-28432 MinIO Information Disclosure Exploited High 7.5
• CVE-2020-11012 Authentication bypass MinIO Admin API Critical 9.3
• CVE-2026-33322 MinIO: JWT Algorithm Confusion in OIDC Authentication Critical 9.2
• CVE-2026-33419 MinIO: LDAP login brute-force via user enumeration and missing rate limit Critical 9.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-v64v-g97p-577c.